d34a18ef1dc8a884fa49790355da5f0244fa71826e667bfb8d2605b63d3f7d98

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 22:52

Target

NEAS.863e3bb35d7d5f51cf849098578d03e0.dll
Size

204KB
MD5

863e3bb35d7d5f51cf849098578d03e0
SHA1

34ff7245a4158bfdee1899e93b6f2fc76ca2cdb9
SHA256

d34a18ef1dc8a884fa49790355da5f0244fa71826e667bfb8d2605b63d3f7d98
SHA512

98e36fe7a29da004ce2d4ea1efa06ace1150884a1412be96f52b8cfce5c51278b81609ce9a0a4f80414c9380019ca6aa2ce64d9205abe74740acd579165ca981
SSDEEP

3072:7HEIQc1ybmsd9Ig2V4Qn3WnzqaCPvpBKazQ/2lQBV+UdE+rECWp7hKyc1:7HL1ybmw9rl0TzQDBV+UdvrEFp7hKyc1

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2824	3552	WerFault.exe	88
1968	3552	WerFault.exe	88

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3552	3840	regsvr32.exe	88
PID 3840 wrote to memory of 3552	3840	regsvr32.exe	88
PID 3840 wrote to memory of 3552	3840	regsvr32.exe	88
PID 3552 wrote to memory of 2824	3552	regsvr32.exe	92
PID 3552 wrote to memory of 2824	3552	regsvr32.exe	92
PID 3552 wrote to memory of 2824	3552	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.863e3bb35d7d5f51cf849098578d03e0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.863e3bb35d7d5f51cf849098578d03e0.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 608
    3⤵
    - Program crash
    PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 608
    3⤵
    - Program crash
    PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3552 -ip 3552
1⤵
PID:2424